# turbopentest [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/integsec/turbopentest-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 161  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/turbopentest-2

## Description
AI-powered penetration testing. Launch scans, review findings, download reports.

## Tools
Capabilities this server exposes over MCP:

- **turbopentest_start_pentest** — Launch an AI-powered penetration test against a target URL. The target domain must be verified first — use turbopentest_list_domains to check. Requires an available credit matching the selected tier — use turbopentest_get_credits to check balance. Returns a pentest ID that can be used with turbopentest_get_pentest to monitor progress.
- **turbopentest_get_pentest** — Retrieve full details for a specific penetration test by its ID. Returns current status, scan progress percentage, findings summary by severity, executive summary, attack surface map, and STRIDE threat model. Use this to monitor a running scan or review completed results. For detailed vulnerability data, follow up with turbopentest_get_findings.
- **turbopentest_list_pentests** — List all your penetration tests with their status and finding counts, ordered newest first. Use this to find pentest IDs, check which scans are running, or review past results. Supports filtering by status and limiting result count. Use turbopentest_get_pentest with a specific ID for full details.
- **turbopentest_get_findings** — Retrieve structured vulnerability findings for a completed penetration test. Each finding includes severity, CVSS score, CWE classification, detailed description, proof of concept, remediation steps, and a retest command. Returns up to 20 findings at a time — use the severity filter to focus on specific risk levels. Use turbopentest_download_report for a complete exportable report.
- **turbopentest_download_report** — Download a full penetration test report in the specified format. The scan must have status 'complete' before a report can be generated. Use format 'markdown' for AI-readable analysis, 'json' for structured programmatic data, or 'pdf' for a professionally formatted document suitable for stakeholders.
- **turbopentest_get_credits** — Check your current credit balance, usage breakdown by tier, and available scan tiers with pricing. Credits are consumed when launching penetration tests — each tier costs one credit of the matching type. Call this before turbopentest_start_pentest to verify you have sufficient credits for the desired tier.
- **turbopentest_verify_attestation** — Verify a blockchain-anchored penetration test attestation by its SHA-256 hash. Returns scan metadata (tier, agents, duration, risk score, finding summary) and blockchain proof (chain ID, transaction hash, block number, merkle root) if anchored. This is a public endpoint — no API key is required. Use this to independently confirm that a pentest was performed and its results are tamper-proof.
- **turbopentest_list_domains** — List all domains in your account with their verification status and expiry dates. A domain must have status 'verified' before it can be used as a target in turbopentest_start_pentest. To verify a new domain, add a DNS TXT record via the TurboPentest dashboard at turbopentest.com/domains.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "turbopentest": {
    "command": "npx",
    "args": ["-y","@turbopentest/mcp-server"],
    "env": {
      "TURBOPENTEST_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `TURBOPENTEST_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What turbopentest MCP server does

The turbopentest MCP server provides an MCP interface to TurboPentest’s penetration-testing API. It lets an AI assistant start a scan for a verified domain, check its progress, inspect findings, and retrieve reports without requiring manual API calls. The server supports four scan tiers: Recon, Standard, Deep, and Blitz. The default is Standard, while the available tiers vary in agent count, estimated duration, and price.

A scan can include a GitHub repository URL for white-box testing. In that mode, TurboPentest adds static analysis, secret detection, and dependency checks for known CVEs alongside black-box testing. The target domain must already be verified on the TurboPentest account. The launch tool checks this condition before requesting the scan and refuses unverified targets.

## How it works

The turbopentest MCP server runs locally through `npx` and sends authenticated requests to TurboPentest over HTTPS. A completed assessment includes scan metadata and a SHA-256 hash for a blockchain-anchored attestation. The public attestation verification tool can validate that hash without an API key and returns available scan metadata together with blockchain proof details.

The server also exposes guided workflow tools for clients that do not support MCP prompts. These return instructions for running a full pentest, analyzing findings, comparing two assessments, and preparing a security-posture briefing. Clients with prompt support can use the corresponding prompts instead.

## Setup and configuration

Install Node.js 18 or newer, create a TurboPentest account, generate an API key, and verify at least one domain in the TurboPentest dashboard. Configure the MCP client to run:

```json
{
  "command": "npx",
  "args": ["@turbopentest/mcp-server"],
  "env": {
    "TURBOPENTEST_API_KEY": "tp_live_..."
  }
}
```

The required `TURBOPENTEST_API_KEY` value comes from the account’s API-key settings. `TURBOPENTEST_API_URL` is optional and defaults to `https://turbopentest.com/api`; it can override the API base URL for testing. The API key is sent as a bearer token to the TurboPentest API and is not logged by the server.

## Tools and capabilities

The turbopentest MCP server exposes tools to:

- Start scans with a selected tier and optional GitHub repository.
- Retrieve progress, finding totals, executive summaries, attack-surface maps, and STRIDE threat models.
- List assessments and filter them by status.
- Retrieve findings filtered by severity, including CVSS, CWE, OWASP category, proof of concept, remediation, and retest commands.
- Download Markdown, JSON, or PDF reports.
- Check credit balance, scan tiers, and pricing.
- List verified domains and their verification states.
- Verify blockchain attestations by SHA-256 hash.
- Return workflow instructions as tools for clients without prompt support.

## Limitations and notes

Scanning is restricted to domains verified on the TurboPentest account. The service uses credits, and the documented tiers are priced from $49 for Recon through $699 for Blitz. Scan durations are approximate, ranging from about 30 minutes to four hours depending on tier.

Prompt-based workflows are documented for Claude Code, Claude Desktop, and Cursor. OpenAI Codex does not support the MCP prompts primitive, so the matching `turbopentest_workflow_*` tools provide those instructions instead. Completed scans can be independently checked through their blockchain attestation, but the attestation endpoint is the only listed tool that does not require an API key.

_Full upstream README: https://allmcps.com/mcp/turbopentest-2/readme_